IN A NUTSHELL https://www.openwall.com/lkrg Twitter: @Openwall Twitter: @Adam_pi3 

/USR/BIN/WHOAMI • Adam ‘pi3’ Zabrocki 2 • NVIDIA (currently) • Microsoft • European Organization for Nuclear Research (CERN) • Hispasec Sistemas • Wroclaw Centre for Networking and Supercomputing • Cigital • Bughunting (Hyper-V, KVM vGPU, Linux kernel, OpenSSH, gcc SSP/ProPolice, Apache, xpdf, more…) – CVEs • Phrack magazine (Scraps of notes on remote stack overflow exploitation) • The ERESI Reverse Engineering Software Interface Private contact: http://pi3.com.pl [email protected] Twitter: @Adam_pi3 

ACKNOWLEDGMENT Alexander Peslyak (Александр Песляк) a.k.a. Solar Designer 3 Special thanks to the following people for the constructive criticism and brainstorming in the past stages of the project development: • Rafał“n3rgal” Wojtczuk • Brad “spender” Spengler • PaX Team… I mean “pipacs” The following people also had impact on LKRG: • Mariusz Zaborski – code cleanups (and hopefully more in the future) • Ilya Matveychikov – bypass techniques, which shaped up protections • Michael Larabel (Phoronix) – benchmarks, which led to optimizations • Patrick Schleizer (Whonix) – packaging with DKMS for Debian-compatibles • Everyone who supported the project on Patreon 

4 WHAT IS LKRG? ❖ LKRG – Linux Kernel Runtime Guard (self-explanatory ;p) 

5 WHAT IS LKRG? ❖ LKRG – Linux Kernel Runtime Guard (self-explanatory ;p) ❖ Open Source project under GPLv2 License 

6 WHAT IS LKRG? ❖ LKRG – Linux Kernel Runtime Guard (self-explanatory ;p) ❖ Open Source project under GPLv2 License LKRG Integrity checking & anti-exploitation System integrity Task integrity x86(-64) ARM ARM64 Critical CPU metadata Critical kernel variables .text section (kernel + modules) Critical attributes Control flow 

7 WHAT IS LKRG? ❖ LKRG – Linux Kernel Runtime Guard (self-explanatory ;p) ❖ Open Source project under GPLv2 License LKRG Integrity checking & anti-exploitation System integrity Task integrity x86(-64) ARM ARM64 Critical attributes Control flow 

8 WHAT IS LKRG? ❖ LKRG – Linux Kernel Runtime Guard (self-explanatory ;p) ❖ Open Source project under GPLv2 License LKRG Integrity checking & anti-exploitation System integrity Task integrity x86(-64) ARM ARM64 Critical attributes Control flow Detects unsupported kernel modifications Default response:panic the kernel (milder response would be ineffective) 

9 WHAT IS LKRG? ❖ LKRG – Linux Kernel Runtime Guard (self-explanatory ;p) ❖ Open Source project under GPLv2 License LKRG Integrity checking & anti-exploitation System integrity Task integrity x86(-64) ARM ARM64 Detects unsupported kernel modifications Default response:panic the kernel (milder response would be ineffective) 

10 WHAT IS LKRG? ❖ LKRG – Linux Kernel Runtime Guard (self-explanatory ;p) ❖ Open Source project under GPLv2 License LKRG Integrity checking & anti-exploitation System integrity Task integrity x86(-64) ARM ARM64 Detects kernel exploitation process Default response:kill the task Detects unsupported kernel modifications Default response:panic the kernel (milder response would be ineffective) 

11 WHAT IS LKRG? ❖ Officially, LKRG is distributed as source code: ❖ https://www.openwall.com/lkrg/ ❖ https://github.com/openwall/lkrg 

12 WHAT IS LKRG? ❖ Officially, LKRG is distributed as source code: ❖ https://www.openwall.com/lkrg/ ❖ https://github.com/openwall/lkrg ❖ LKRG as a package: ❖ ALT Linux ❖ Arch Linux (aur) ❖ Astra Linux ❖ Debian and Ubuntu (reusing the Whonix/Kicksecure package) ❖ Gentoo Linux (Pentoo Overlay) ❖ Whonix and Kicksecure ❖ + a few other less known 

13 WHAT IS LKRG? ❖ Officially, LKRG is distributed as source code: ❖ https://www.openwall.com/lkrg/ ❖ https://github.com/openwall/lkrg ❖ LKRG as a package: ❖ ALT Linux ❖ Arch Linux (aur) ❖ Astra Linux ❖ Debian and Ubuntu (reusing the Whonix/Kicksecure package) ❖ Gentoo Linux (Pentoo Overlay) ❖ Whonix and Kicksecure ❖ + a few other less known ❖ LKRG-aware exploitation frameworks: ❖ Metasploit bails out ❖ Exploit-suggester bails out 

14 ANTI-EXPLOITATION ❖ The aim of it is to detect kernel exploitation process by detecting specific data corruption in the kernel 

15 ANTI-EXPLOITATION ❖ The aim of it is to detect kernel exploitation process by detecting specific data corruption in the kernel Critical process’ and system’s attributes Poor man's Control Flow Integrity (pCFI) 

16 ANTI-EXPLOITATION ❖ The aim of it is to detect kernel exploitation process by detecting specific data corruption in the kernel Critical process’ and system’s attributes Poor man's Control Flow Integrity (pCFI) • Illegal Elevation of Privileges (EoP): • Token / pointer swapping • Illegal call to commit_creds() • Overwriting the cred / real_cred structures • Sandbox escapes (e.g. Chrome sandbox): • Overwriting seccomp configuration • Overwriting seccomp rules • Various namespace escapes • Various container escapes (e.g.Docker / Kubernetes / etc.) • Illegal changes of: • CPU state e.g. SMAP / SMEP / WP / MSR • Any part of the kernel or modules 

17 ANTI-EXPLOITATION ❖ The aim of it is to detect kernel exploitation process by detecting specific data corruption in the kernel Critical process’ and system’s attributes Poor man's Control Flow Integrity (pCFI) • Illegal Elevation of Privileges (EoP): • Token / pointer swapping • Illegal call to commit_creds() • Overwriting the cred / real_cred structures • Sandbox escapes (e.g. Chrome sandbox): • Overwriting seccomp configuration • Overwriting seccomp rules • Various namespace escapes • Various container escapes (e.g.Docker / Kubernetes / etc.) • Illegal changes of: • CPU state e.g. SMAP / SMEP / WP / MSR • Any part of the kernel or modules • It might detect (and block) • Return-Oriented-Programming (ROP) • Stack-pivoting attacks • It might detect illegal control flow: • From non .text section pages • From dynamically generated executable pages • From pages not belonging to the kernel (e.g. user-mode pages) • When attacker bypasses SMEP protection 

18 ANTI-EXPLOITATION ❖ Examples ❖ Detection of calls into kernel APIs from non-code pages (CVE-2017-1000112) 

19 ANTI-EXPLOITATION ❖ Examples ❖ Detection of calls into kernel APIs from non-code pages (CVE-2017-1000112) 

20 ANTI-EXPLOITATION ❖ Examples ❖ Detection of calls into kernel APIs from non-code pages (CVE-2017-1000112) 

21 ANTI-EXPLOITATION ❖ Examples ❖ Detection of calls into kernel APIs from non-code pages (CVE-2017-1000112) 

22 ANTI-EXPLOITATION ❖ Examples ❖ Detection of calls into kernel APIs from non-code pages (CVE-2017-1000112) 

23 ANTI-EXPLOITATION ❖ Examples ❖ ROP detection 

24 ANTI-EXPLOITATION ❖ Examples ❖ ROP detection 

25 ANTI-EXPLOITATION ❖ Examples - metasploit Terminal: LKRG Terminal: Metasploit 

26 ANTI-EXPLOITATION ❖ Limitations – Bypassableby design (for now) – difficult to protect from the same trust level ▪ Fly under LKRG’s radar: ✓ Overwrite critical metadata not guarded by LKRG ✓ Try to win races ✓ Move attack to userspace ▪ Attack (disable) LKRG and continue normal work: ✓ Try to win races (corrupting LKRG’s database) ✓ Attack LKRG’s internal synchronization / locking ✓ Find all LKRG’s running contexts and disable them + block a new one ▪ Directly attack the userspace via kernel (e.g. DirtyCOW) 

27 SYSTEM INTEGRITY ❖ Calculate hash from the critical [meta]data – SipHash ❖ Guarded regions: ▪ Critical (V)CPU/core data – Inter-Processor-Interrupt (IPI) is sent to the individual core in all (V)CPUs to exclusively run LKRG’s guard function (IDT/MSR/CRx/etc.) ▪ LKRG keeps information about how many (V)CPU/cores are „online” / „offline” / „possible” ▪ Entire Linux kernel .text section ▪ This covers almost entire Linux kernel itself, like syscall tables, all procedures, all function, all IRQ handlers, etc. ▪ Entire Linux kernel .rodata section ▪ Entire Linux kernel exception table ▪ Critical global system variables, like: ▪ selinux_enabled ▪ selinux_enforcing / selinux_state ▪ Supervisor Mode Execution Protection (SMEP) and Supervisor Mode Access Prevention (SMAP) ▪ CR4.WP ▪ All dynamically loaded modules AND their order in the internal structures ▪ Optionally,it is possible to enable guard of the entire IOMMU table 

28 SYSTEM INTEGRITY ❖ Calculate hash from the critical [meta]data – SipHash ❖ Guarded regions: ▪ Critical (V)CPU/core data – Inter-Processor-Interrupt (IPI) is sent to the individual core in all (V)CPUs to exclusively run LKRG’s guard function (IDT/MSR/CRx/etc.) ▪ LKRG keeps information about how many (V)CPU/cores are „online” / „offline” / „possible” ▪ Entire Linux kernel .text section ▪ This covers almost entire Linux kernel itself, like syscall tables, all procedures, all function, all IRQ handlers, etc. ▪ Entire Linux kernel .rodata section ▪ Entire Linux kernel exception table ▪ Critical global system variables, like: ▪ selinux_enabled ▪ selinux_enforcing / selinux_state ▪ Supervisor Mode Execution Protection (SMEP) and Supervisor Mode Access Prevention (SMAP) ▪ CR4.WP ▪ All dynamically loaded modules AND their order in the internal structures ▪ Optionally,it is possible to enable guard of the entire IOMMU table SELinux escape Often changed by rootkits Detects SMAP / SMEP bypasses 

29 COMMUNICATION CHANNEL ❖ Through the sysctl interface: root@pi3-ubuntu:~/p_lkrg-main# sysctl -a|grep lkrg lkrg.block_modules = 0 lkrg.heartbeat = 0 lkrg.hide = 0 lkrg.interval = 15 lkrg.kint_enforce = 2 lkrg.kint_validate = 3 lkrg.log_level = 3 lkrg.msr_validate = 1 lkrg.pcfi_enforce = 1 lkrg.pcfi_validate= 2 lkrg.pint_enforce = 1 lkrg.pint_validate= 3 lkrg.profile_enforce = 2 lkrg.profile_validate = 9 lkrg.smap_enforce = 2 lkrg.smap_validate= 1 lkrg.smep_enforce = 2 lkrg.smep_validate = 1 lkrg.trigger = 0 lkrg.umh_enforce = 1 lkrg.umh_validate = 1 

30 PERFORMANCE AND SCALABILITY ❖ LKRG with default protections enabled: CPU: Intel Xeon E-2176G @ 4.70GHz (6 Cores / 12 Threads) OS: Ubuntu 18.04 • The newest version (0.8) has overhead around ~2.5% All details are available in PERFORMANCE file • Performance impact was also comprehensively evaluated by Phoronix: https://www.phoronix.com/scan.php?page=article&item=lkrg-08-linux&num=1 ❖ Scalability: • We do NOT expect a significant increase in LKRG's overhead with a higher number of concurrently running processes. LKRG's process tracking database uses a hash table of RB trees with per-hash-bucket read/write-locks. 

31 https://www.openwall.com/lkrg Q&A?